F-6736: align critical/non-critical extension OID getters with X509 contract

src/java/com/wolfssl/provider/jsse/WolfSSLX509.java

@@ -623,48 +623,54 @@ public class WolfSSLX509 extends X509Certificate {
     }
 
 
-    public Set<String> getCriticalExtensionOIDs() {
+    /* Shared impl for the critical/non-critical extension OID getters below.
+     * wantExtSet selects which to collect: 2 critical, 1 non-critical (per
+     * WolfSSLCertificate.getExtensionSet()). Per the X509Certificate contract,
+     * returns null only when no extensions are present, else a possibly-empty
+     * Set. Presence is only detected for the extensionOid list above, so a
+     * cert carrying only other extensions is treated as having none. */
+    private Set<String> getExtensionOIDs(int wantExtSet) {
         int i;
+        int extCount = 0;
         Set<String> ret = new TreeSet<String>();
 
-        WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
-            () -> "entered getCriticalExtensionOIDs()");
-
         if (this.cert == null) {
             return null;
         }
 
         for (i = 0; i < this.extensionOid.length; i++) {
-            if (this.cert.getExtensionSet(this.extensionOid[i]) == 2) {
+            int extSet = this.cert.getExtensionSet(this.extensionOid[i]);
+            if (extSet == 1 || extSet == 2) {
+                extCount++;
+            }
+            if (extSet == wantExtSet) {
                 ret.add(this.extensionOid[i]);
             }
         }
 
-        if (ret.size() == 0)
+        if (extCount == 0) {
             return null;
+        }
 
         return ret;
     }
 
 
+    public Set<String> getCriticalExtensionOIDs() {
+
+        WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
+            () -> "entered getCriticalExtensionOIDs()");
+
+        return getExtensionOIDs(2);
+    }
+
+
     public Set<String> getNonCriticalExtensionOIDs() {
-        int i;
-        Set<String> ret = new TreeSet<String>();
 
         WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
             () -> "entered getNonCriticalExtensionOIDs()");
 
-        if (this.cert == null) {
-            return null;
-        }
-
-        for (i = 0; i < this.extensionOid.length; i++) {
-            if (this.cert.getExtensionSet(this.extensionOid[i]) == 1) {
-                ret.add(this.extensionOid[i]);
-            }
-        }
-
-        return ret;
+        return getExtensionOIDs(1);
     }
 
 

src/test/com/wolfssl/provider/jsse/test/WolfSSLTestFactory.java

@@ -88,6 +88,7 @@ class WolfSSLTestFactory {
 
     protected String googleCACert;
     protected String exampleComCert;
+    protected String clientCertDer;
 
     protected final static String jksPassStr = "wolfSSL test";
     protected final static char[] jksPass = jksPassStr.toCharArray();
@@ -136,6 +137,7 @@ class WolfSSLTestFactory {
         /* External CA certificate files */
         googleCACert     = "examples/certs/ca-google-root.der";
         exampleComCert   = "examples/certs/example-com.der";
+        clientCertDer    = "examples/certs/client-cert.der";
 
         /* test if running from IDE directory */
         File f = new File(serverJKS);
@@ -174,6 +176,7 @@ class WolfSSLTestFactory {
 
         googleCACert = in.concat(googleCACert);
         exampleComCert = in.concat(exampleComCert);
+        clientCertDer = in.concat(clientCertDer);
     }
 
     private boolean isIDEFile() {

src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java

@@ -228,6 +228,35 @@ public class WolfSSLX509Test {
         }
     }
 
+    @Test
+    public void testCriticalExtensionOIDsEmptyNotNull() {
+
+        WolfSSLX509 x509;
+        Set<String> crit;
+        Set<String> nonCrit;
+
+        /* skip if wolfSSL compiled with NO_FILESYSTEM */
+        Assume.assumeTrue(WolfSSL.FileSystemEnabled());
+
+        try {
+            /* client-cert.der has non-critical extensions present but none
+             * marked critical. A cert that has extensions must return a
+             * possibly-empty Set from getCriticalExtensionOIDs(), not null. */
+            x509 = new WolfSSLX509(tf.clientCertDer);
+
+            crit = x509.getCriticalExtensionOIDs();
+            assertNotNull(crit);
+            assertTrue(crit.isEmpty());
+
+            nonCrit = x509.getNonCriticalExtensionOIDs();
+            assertNotNull(nonCrit);
+            assertFalse(nonCrit.isEmpty());
+
+        } catch (Exception ex) {
+            fail("unexpected exception found");
+        }
+    }
+
     @Test
     public void testX509XValidity() {
         WolfSSLX509X x509;